From de52d4a1ece3a7887283698c1aec86b1da3cdaa2 Mon Sep 17 00:00:00 2001
From: seonNoh <dark.pearl.nst@gmail.com>
Date: Thu, 24 Sep 2026 01:46:17 +0900
Subject: [PATCH] fix: run ingress-nginx admission jobs as Argo CD sync hooks;
 fix front links
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- ingress-nginx admission Job 2개는 ttlSecondsAfterFinished: 0으로 완료 즉시 사라져
  Argo CD가 영구 OutOfSync로 보고 selfHeal 때마다 다시 실행했다(2026-09-24 실측).
  Sync 훅(HookSucceeded 삭제)으로 돌린다.
- front 정적 페이지의 /api/readyz 링크(404)를 제거한다(api의 /readyz는 /api 아래가 아님).
---
 workloads/demo-app/front.yaml              |  2 +-
 workloads/ingress-nginx/kustomization.yaml | 12 ++++++++++++
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/workloads/demo-app/front.yaml b/workloads/demo-app/front.yaml
index d475a37..9d75b92 100644
--- a/workloads/demo-app/front.yaml
+++ b/workloads/demo-app/front.yaml
@@ -22,7 +22,7 @@ data:
     <!doctype html><html lang="ja"><meta charset="utf-8"><title>selfheal demo</title>
     <body style="font-family:system-ui;margin:2rem"><h1>selfheal demo front</h1>
     <p>container layer (AWS k8s) -&gt; VPN -&gt; VM layer (GCP legacy-api, PostgreSQL)</p>
-    <ul><li><a href="/api/orders">/api/orders</a></li><li><a href="/api/price/apple">/api/price/apple</a></li><li><a href="/api/readyz">/api/readyz</a></li></ul>
+    <ul><li><a href="/api/orders">/api/orders</a></li><li><a href="/api/price/apple">/api/price/apple</a></li><li><a href="/api/price/nothere">/api/price/nothere (404)</a></li></ul>
     </body></html>
 ---
 apiVersion: apps/v1
diff --git a/workloads/ingress-nginx/kustomization.yaml b/workloads/ingress-nginx/kustomization.yaml
index a4ef331..984c15d 100644
--- a/workloads/ingress-nginx/kustomization.yaml
+++ b/workloads/ingress-nginx/kustomization.yaml
@@ -16,3 +16,15 @@ patches:
       - op: add
         path: /spec/ports/1/nodePort
         value: 30443
+  # The admission Jobs have ttlSecondsAfterFinished: 0 and vanish after they complete, which Argo CD would report as
+  # OutOfSync forever (and re-run on every selfHeal). Run them as Sync hooks instead and let Argo CD delete them.
+  - target:
+      kind: Job
+      name: ingress-nginx-admission-.*
+      namespace: ingress-nginx
+    patch: |-
+      - op: add
+        path: /metadata/annotations
+        value:
+          argocd.argoproj.io/hook: Sync
+          argocd.argoproj.io/hook-delete-policy: HookSucceeded